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What is claimed is: 

1 . A method comprising: 

5 copying a disk image to a hard disk drive on a managed platform, wherein 

the disk image is copied from a model disk image stored on a storage device of a 
remote management system; 

during a user session on the managed platform, monitoring write 
commands from an operating system of the managed platform; 
10 in response to detecting write commands from the operating system that 

address blocks of the hard disk drive, automatically updating a write log to identify 
the blocks addressed by the write commands; 

after completion of the user session, automatically determining whether 
one or more blocks of the hard disk drive were modified, based at least in part on 
15 the write log; and 

in response to determining that at least one block in the hard disk drive was 
modified, automatically restoring original contents to the modified block during a 
boot process for the managed platform by overwriting the modified block with 
corresponding backup data from the model disk image, 

20 

2. A method according to claim 1 , wherein the operation of copying a disk 
image to a hard disk drive on a managed platform comprises: 

provisioning the managed platform with software by automatically loading 
the disk image into the managed platform from the remote management system 
25 during a boot process for the managed platform. 

3. A method according to claim 1 , wherein the disk image comprises an 
image of a disk partition. 

30 4. A method according to claim 1 , further comprising: 

terminating the operating system on the managed platform before restoring 
the original contents to the modified block from the remote management system. 

14 
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5. A method according to claim 4, further comprising: 

launching the operating system on the managed platform after restoring the 
original contents to the modified block from the model disk image. 

6. A method comprising: 

during a user session on a platform, In response to write commands 
addressing blocks of a storage device in the platfonn, automatically updating a 
write log to identify the blocks addressed by the write commands; 

after completion of the user session, automatically identifying one or more 
modified blocks In the storage device, based at least In part on the write log; and 

in response to Identifying at least one modified block in the storage device, 
automatically replacing data in the modified block with backup data from a 
different storage device. 

7. A method according to claim 6, further comprising: 

in advance of the user session, provisioning the platform with software by 
copying a disk Image to the storage device In the platform from a model disk 
image stored on the different storage device. 

8. A method according to claim 7, wherein the operation of copying a disk 
Image comprises copying the disk image from a remote data processing system. 

9. A method according to claim 6, wherein the storage device in the platform 
comprises a hard disk drive. 

10. A method according to claim 6, wherein the operation of automatically 
replacing data in the modified block with backup data from a different storage 
device comprises: 

automatically restoring the modified block during a boot process for the 
platform by ovenwrlting the modified block with corresponding backup data from a 
model disk Image. 

11. A method according to claim 6, further comprising: 

15 
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terminating an operating system on the platform before replacing the data 
in the modified block with backup data from the different storage device. 

12. A method according to claim 1 1 , further comprising: 

5 launching the operating system on the platform after replacing the data In 

the modified block with backup data from the different storage device. 

13. An apparatus comprising: 

a machine accessible medium; and 
10 instructions encoded in the machine accessible medium, wherein the 

instructions, when executed by a processing system, perform operations 
comprising: 

during a user session on the processing system, in response to write 
commands addressing blocks of a storage device in the processing system, 
15 automatically updating a write log to identify the blocks addressed by the write 
commands; 

after completion of the user session, automatically identifying one or more 
modified blocks in the storage device, based at least in part on the write log; and 

in response to identifying at least one modified block in the storage device, 
20 automatically replacing data In the modified block with backup data from a 
different storage device. 

14. An apparatus according to claim 13, wherein the instructions comprise 
firmware instructions to execute before the processing system boots to an 

25 operating system. 

15. An apparatus according to claim 13, wherein the instructions perform 
further operations comprising: 

in advance of the user session, provisioning the processing system with 
30 software by copying a disk image to the storage device In the processing system 
from a model disk image stored on the different storage device. 
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16. An apparatus according to claim 15, wherein the instructions cause the 
processing system to copy the disk image from a remote data processing system. 

17. An apparatus according to claim 13, wherein the storage device in the 
5 processing system comprises a hard disk drive. 

18. An apparatus according to claim 13, wherein the operation of automatically 
replacing data in the modified block with backup data from a different storage 
device comprises: 

10 automatically restoring the modified block during a boot process for the 

processing system by overwriting the modified block with corresponding backup 
data from a model disk image. 

19. An apparatus according to claim 13, wherein the instructions perform 
1 5 further operations comprising: 

terminating an operating system on the processing system before replacing 
the data in the modified block with backup data from the different storage device. 

20. An apparatus according to claim 19, wherein the instructions perform 
20 further operations comprising: 

launching the operating system on the platform after replacing the data in 
the modified block with backup data from the different storage device. 

21 . A processing system comprising: 
25 a machine accessible medium; 

a storage device; 
a processor; 

one or more communication paths to couple the processor with the 
machine accessible medium and the storage device; and 
30 instructions encoded in the machine accessible medium, wherein the 

instructions, when executed by the processor, perform operations comprising: 
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during a user session on the processing system, in response to write 
comnnands addressing blocks of the storage device, automatically updating a 
write log to identify the blocks addressed by the write commands; 

after completion of the user session, automatically identifying one or more 
5 modified blocks in the storage device, based at least in part on the write log; and 

in response to identifying at least one modified block in the storage device, 
automatically replacing data in the modified block with backup data from a 
different storage device. 

10 22. A processing system according to claim 21 , wherein the instructions 

comprise firmware instructions to execute before the processing system boots to 
an operating system. 

23. A processing system according to claim 21 , wherein the instructions 
1 5 perform further operations comprising: 

in advance of the user session, provisioning the processing system with 
software by copying a disk image to the storage device in the processing system 
from a model disk Image stored on the different storage device. 

20 24. A processing system according to claim 23, wherein the instructions cause 
the processing system to copy the disk image from a remote data processing 
system. 

25. A processing system according to claim 24, further comprising the remote 
25 data processing system. 

26. A processing system according to claim 21 , wherein the storage device In 
the processing system comprises a hard disk drive. 

30 27. A processing system according to claim 21 , wherein the operation of 
automatically replacing data in the modified block with backup data from a 
different storage device comprises: 
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automatically restoring the modified block during a boot process for the 
processing system by overwriting the modified block with corresponding backup 
data from a model disk image. 

28. A processing system according to claim 21 , wherein the instructions 
perform further operations comprising: 

terminating an operating system on the processing system before replacing 
the data in the modified block with backup data from the different storage device. 

29. A processing system according to claim 28, wherein the instructions 
perform further operations comprising: 

launching the operating system on the platform after replacing the data in 
the modified block with backup data from the different storage device. 
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